\chapter{Check for irreducible polynomial in Matlab}
\label{app:irreducible-polynomial}
Following is the input to Matlab.
 
\begin{lstlisting}[frame=tb]
p = [1,0,1,1,0,0,1,1,1,0,0,0,0,0,0,0,1,0,0,0,0,0,1,1,0,
		0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,1,1,0,0,1,1,1]

p =  Columns 1 through 12

     1  0  1  1  0  0  1  1  1  0  0  0

  	 Columns 13 through 24

     0  0  0  0  1  0  0  0  0  0  1  1

     Columns 25 through 36

     0  0  1  0  0  0  1  0  0  0  0  0

     Columns 37 through 48

     0  0  0  0  0  1  1  1  0  0  1  1

     Column 49

     1
\end{lstlisting}

No decisive output is observed from Matlab for approximately 24 hours. Hence, program is terminated.

\chapter{HiTag2 library}
\label{app:hitag2-lib}
Following is the implementation of the HiTag2 stream cipher in C language.
 
\begin{lstlisting}[frame=tb]
#include<stdio.h>
#include "common.h"
#include "hitag2.h"

static u64 hitag2_output(const u64 x)
{
	u64 i5;

	i5 = ((ht2_f4a >> i4 (x, 1, 2, 4, 5)) & 1)* 1
	   + ((ht2_f4b >> i4 (x, 7,11,13,14)) & 1)* 2
	   + ((ht2_f4b >> i4 (x,16,20,22,25)) & 1)* 4
	   + ((ht2_f4b >> i4 (x,27,28,30,32)) & 1)* 8
	   + ((ht2_f4a >> i4 (x,33,42,43,45)) & 1)*16;

	return (ht2_f5c >> i5) & 1;
}

u64 hitag2_init(const u64 key, const u32 serial, const u32 IV)
{
	u32 i = 0;
	u64 x = ((key & 0xFFFF) << 32) + serial;

	for (i = 0; i < 32; i++)
	{
		x >>= 1;
		x += (u64) (hitag2_output(x) ^ (((IV >> i) ^ 
		(key >> (i+16))) & 1)) << 47;
	}
	return x;
}

static u64 hitag2_round(u64 *state)
{
	u64 x = *state;

	x = (x >>  1) +
	 ((((x >>  0) ^ (x >>  2) ^ (x >>  3) ^ (x >>  6)
	  ^ (x >>  7) ^ (x >>  8) ^ (x >> 16) ^ (x >> 22)
	  ^ (x >> 23) ^ (x >> 26) ^ (x >> 30) ^ (x >> 41)
	  ^ (x >> 42) ^ (x >> 43) ^ (x >> 46) ^ (x >> 47)) & 1)
	  << 47);

	*state = x;
	return hitag2_output(x);
}

static u64 hitag2_byte(u64 * x)
{
	u64 i;
	u64 c;

	for (i = 0, c = 0; i < 8; i++) 
		c += (u64) hitag2_round(x) << (7 - i);
	return c;
}

u64 hitag2_prefix(u64 * x, u32 bits)
{
	u64 i;
	u64 prefix = 0;

	for (i = 0; i < (bits/8); i++)
	{
		prefix += 
		(u64) hitag2_byte (x) << ((bits/8) - 1 - i)*8;
	}
	return prefix;
}

void hitag2_prev_state(u64 *state)
{
	u64 x = *state;

	x = (x <<  1) +
	(((x >>  47) ^ (x >>  1) ^ (x >>  2) ^ (x >>  5)
	  ^ (x >>  6) ^ (x >>  7) ^ (x >> 15) ^ (x >> 21)
	  ^ (x >> 22) ^ (x >> 25) ^ (x >> 29) ^ (x >> 40)
	  ^ (x >> 41) ^ (x >> 42) ^ (x >> 45) ^ (x >> 46)) & 1);

	*state = x & 0xFFFFFFFFFFFFULL;
}

void hitag2_next_state(u64 *state)
{
	u64 x = *state;

	x = (x >>  1) +
	 ((((x >>  0) ^ (x >>  2) ^ (x >>  3) ^ (x >>  6)
	  ^ (x >>  7) ^ (x >>  8) ^ (x >> 16) ^ (x >> 22)
	  ^ (x >> 23) ^ (x >> 26) ^ (x >> 30) ^ (x >> 41)
	  ^ (x >> 42) ^ (x >> 43) ^ (x >> 46) ^ (x >> 47)) & 1) 
	  << 47);

	*state = x;
}

u64 hitag2_find_key(u64 initial_state, const u32 serial, 
	const u32 IV)
{
	u64 last_bit = 0;
	u64 key = 0;
	u64 state = 0;
	s32 i = 31;

	state = initial_state;

	for (i = 31; i >= 0; i--)
	{
		last_bit = (state >> 47);

		key = key + (((last_bit ^ hitag2_output(state) ^ 
			(IV >> i)) & 1) << (i + 16));
		state = (state << 1) + (u64) ((serial >> i) & 1);
	}
	
	key = key ^ ((state >> 32) & 0xFFFF);
	return key;
}
\end{lstlisting}

\chapter{C Program to check period of random number generator}
\label{app:random-function}

The following listing contains the C program for checking the period of a random generator function. The function \textit{get\_random\_2} introduced in section \ref{sec:keystream-attack-impl} is used in the listed program. However, this can be changed to check the desired function. 

The implementation checks for repetition of three consecutive random numbers. We believe checking three numbers is sufficient to identify a the repeating sequence.\\

\begin{lstlisting}[frame=tb]
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <math.h>

#define u8			unsigned char
#define u32			unsigned int
#define u64			unsigned long long

int main(void)
{
	time_t seconds;
	u64 runtime = 0;
	u64 i = 0;
	u64 first_random = 0;
	u64 second_random = 0;
	u64 third_random = 0;

	u64 random = 0;

	time(&seconds);
	srand(seconds);

	runtime = pow(2,32);
	
	first_random = get_random_2(48);
	second_random = get_random_2(48);
	third_random = get_random_2(48);
	
	printf("\nFirst random number: %llx", first_random);
	printf("\nSecond random number: %llx", second_random);
	printf("\nThird random number: %llx", third_random);
	
	for(i = 0; i < runtime; i++)
	{
		random = get_random_2(48);	
		
		if(random == first_random)
		{
			printf("\n\n Reoccurence: %llu\n", i);
			random = get_random_2(48);

			if(random == second_random)
			{
				random = get_random_2(48);
				
				if(random == third_random)
				{
				 printf("\n\n Repetition of 
				     random number! 
				     Period: %llu\n", i);
				 break;
				}
			}
		}
	}
}			
\end{lstlisting}

\chapter{Size of precomputation files}
\label{app:size-precomp-files}

Sizes of the precomputation files for Hellman tables is given below. 
\begin{table}[ht!]
\begin{center}
\caption{Precomputation file sizes for Hellman tables}
\smallskip
\smallskip
\begin{tabular}{|p{3.5cm}||c|c|c|c|c|c|c|}
\hline
m																				&	$2^{12}$ 	&	$2^{14}$ 	&	$2^{14}$ 	&	$2^{14}$ 	&	$2^{14}$ 	&	$2^{16}$ 	&	$2^{16}$	\\ 
t	  																		&	$2^{12}$ 	&	$2^{10}$ 	&	$2^{12}$ 	&	$2^{17}$ 	&	$2^{17}$ 	&	$2^{16}$ 	&	$2^{16}$	\\ 
r	  																		&	$2^{8}$ 	&	$2^{8}$ 	&	$2^{6}$ 	&	$2^{1}$	 	&	$2^{2}$ 	&	$2^{1}$ 	&	$2^{2}$		\\ \hline \hline
Precomputation file size (MB)						&	30.4 			&	121 			&	30.4 			&	0.95			&	1.9	 			&	3.8 			&	7.61			\\ \hline
\end{tabular}
\smallskip
\end{center}
\label{tab:file-sizes-hellman}
\end{table}


\noindent Sizes of the precomputation files for rainbow table is given below. 
\begin{table}[ht!]
\begin{center}
\caption{Precomputation file sizes for rainbow table}
\smallskip
\smallskip
\begin{tabular}{|p{3.5cm}||c|c|c|c|c|c|c|}
\hline
M																				&	$2^{23}$ 	&	$2^{24}$ 	&	$2^{24}$ 	&	$2^{25}$ 	\\ 
t	  																		&	$2^{9}$ 	&	$2^{8}$ 	&	$2^{9}$ 	&	$2^{9}$ 	\\ \hline \hline 
Precomputation file size (MB)						&	243 			&	487 			&	487 			&	974				\\ \hline
\end{tabular}
\smallskip
\end{center}
\label{tab:file-sizes-rainbow}
\end{table}
